Running client scenario 'dns-rebinding-protection' against server: http://127.0.0.1:3954/mcp
Checks:
2026-07-29T03:32:21.367Z [localhost-host-rebinding-rejected] SUCCESS Server rejects requests with non-localhost Host/Origin headers
2026-07-29T03:32:21.367Z [localhost-host-valid-accepted    ] SUCCESS Server accepts requests with valid localhost Host/Origin headers

Test Results:
Passed: 2/2, 0 failed, 0 warnings
